Extreme Networks case sets a diligence bar for distributors far from Moscow

Extreme Networks settled with the US Office of Foreign Assets Control (OFAC) on 27 October for $1,529,685 over networking equipment that reached a Russian missile maker through a distributor and an acquired contract, as our news piece reports.

The Justice Department settled the same day for $975,721.84. This Analysis asks what the two documents change for three readers: a distributor or reseller in an emerging market, a bank that clears dollars for one, and a regulator that supervises both.

The answer, on these documents, is that the US agencies have written down the precise moments at which a sale became a violation, and each of those moments ran through an intermediary: a Russian subsidiary, a third-party distributor whose location neither document gives, and an end user named on the orders under another company's name. The enforcement release is as much a manual for intermediaries as a penalty notice.

For a distributor: the website test

The release records that in October and November 2020 Extreme asked its distributor for the end user's website while checking two orders. The distributor twice supplied the site of JSC Moskovskiy Mashinostroitelniy Zavod Avangard (MMZA), the blocked company, and after Extreme raised MMZA's military ties, supplied the site of DEMZ, the company named on the orders, and said the earlier references were a mistake. Extreme accepted an end-user statement from the same distributor and approved the orders. OFAC's finding of reckless disregard rests on Extreme's failure to heed what it calls numerous warning signs that MMZA was the real recipient, and the Justice Department's press release records that Extreme later terminated the distributor's contract as part of its remediation.

For a reseller in Istanbul, Dubai or Almaty that moves US-origin goods, the practical change is that an end-user statement no longer closes the file once the supplier has seen a conflicting signal. The release records the signals Extreme had in hand: email domains and an office address that did not match the named buyer, a distributor whose explanations changed, and its own subsidiary's instruction to MMZA staff to register on the customer portal under DEMZ's name while using MMZA addresses. It says diligence should be redoubled in the presence of red flags, and its general sentence reads: "Inconsistent explanations and questionable end-user representations are red flags that should be cause for particular concern." On these documents, a distributor that supplies one answer and then another should expect the supplier's compliance team to stop the order rather than file the statement. The earlier $175,015 settlement with a freight forwarder that missed a renamed Chinese supplier made the same point about names; this one makes it about owners and addresses.

For a bank: ownership, not only names

MMZA was not on OFAC's list until 28 June 2022, yet the release treats it as blocked from the first order in September 2018, because JSC Concern Almaz-Antey, designated on 16 July 2014, held a majority of it. OFAC's rule that an entity owned 50 per cent or more, in the aggregate, by one or more blocked persons is itself blocked did the work. The release says Extreme's screening ran each order against a company-wide Russia policy and missed MMZA, and that the firm's remediation now includes screening for majority-owned and military-linked entities.

A bank in an emerging market that clears dollar payments for exporters or distributors faces the same gap. Its sanctions screening matches names on a list; the Extreme release penalises a company for not resolving who owned a customer that was not on the list. On these documents, the screening question for a trade finance desk moves from "is the counterparty listed" to "do blocked persons, alone or together, own half of it", and the data to answer it sits in corporate registries rather than in the SDN file. Treasury's September designation of Golden Global Bank in Türkiye and its October action against Iraq's International Development Bank, set out in the September catch-up and the Iraq piece, show the other end of the same policy: banks that carry the payments become targets themselves.

For a regulator: the near miss and the whistleblower

The Justice Department describes its agreement as the first "near miss" non-prosecution agreement under its 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy, a category for a case "that involved full cooperation and appropriate remediation but did not qualify for a declination of prosecution". The reason is specific: the disclosure was not timely because it "occurred under imminent threat of disclosure by a news publication". The company still obtained the agreement, paid a criminal fine of $487,860.92, the figure the department gives as its approximate revenue from the sales, and forfeited the same amount.

For a supervisor in Baku, Tashkent or Riyadh writing or applying a corporate self-reporting regime, the US documents show two design choices. The first is a middle category between a declination and a prosecution for companies that disclose late but cooperate fully; the Justice Department has now used it once and published the terms. The second is a paid whistleblower channel: OFAC's release closes by noting that FinCEN's programme can pay awards on information leading to penalties above $1,000,000, in a case where the disclosure came, in the Justice Department's words, "under imminent threat of disclosure by a news publication"; neither document records a regulator's inquiry before it. On these documents, the company disclosed under that threat and was credited for what it did next; an emerging-market regulator without either channel has fewer routes to a case of this kind.

Neither document names the distributor, the Russian communications business whose contracts Extreme's Russian subsidiary bought in March 2018, or the news publication. Neither gives the value of each export; the OFAC settlement agreement has Extreme pay $1,041,824 to the Treasury and treats the remaining $487,861 as satisfied by its payments under the Justice Department agreement, so the two sums are not simply added; and the two agencies count differently: OFAC cites nine exports from September 2018 to March 2022, the Justice Department 11 purchase orders from around March 2018 to March 2022, and the release does not reconcile them. Both resolutions are negotiated; neither is a court finding, and the company's filing of 28 October on its quarterly results does not mention them. The settlement is below the base penalty of $1,699,650 by $169,965, a small discount for a case OFAC itself calls egregious; OFAC credits the self-disclosure, which halved the base, while the Justice Department calls the same disclosure not timely. On these documents, that is how the two agencies now price a disclosure made under pressure: as cooperation worth a reduction, not a defence.